CI on the Bundle L merge (e453677) failed at golangci-lint:
internal/connector/issuer/stepca/jwe_failure_test.go:105:16:
QF1008: could remove embedded field 'PublicKey' from selector
internal/connector/issuer/stepca/jwe_failure_test.go:106:16: same
internal/connector/issuer/stepca/jwe_failure_test.go:241:9: same
ecdsa.PrivateKey embeds PublicKey, so 'key.PublicKey.X' is
redundantly traversing the embedded field. The shorter 'key.X'
compiles to the same access via the embedded promotion.
Verified clean via 'staticcheck -checks all' (only pre-existing
ST1000 'no package comment' hits remain, predating this bundle).
Tests still PASS at 90.4% coverage; semantics unchanged.
CI on the Bundle J merge (18e46f0) failed at golangci-lint:
internal/connector/issuer/acme/acme_failure_test.go:244:3:
QF1002: could use tagged switch on r.URL.Path (staticcheck)
TestGetRenewalInfo_ARI5xx had a switch{} with case r.URL.Path == ...
which staticcheck QF1002 flags as a quick-fix candidate (use tagged
switch instead). The function also accumulated dead ts/ts2/ts3 setup
from earlier iteration — only ts3 was actually used by the assertion.
This commit:
- Collapses the 3-server scaffold into a single ts using if/return
instead of switch (sidesteps QF1002 entirely + removes ~25 LoC of
dead code)
- Verifies via 'staticcheck -checks all' (which includes QF*) that
the package is clean except for pre-existing ST1000 hits in
acme.go/ari.go/dns.go/profile.go (out of scope for this fix)
Verification:
staticcheck -checks all internal/connector/issuer/acme/... clean
(excluding 4 pre-existing ST1000 'missing package comment')
go vet ./internal/connector/issuer/acme/... clean
go test -short ./internal/connector/issuer/acme/... PASS
Coverage unchanged at 55.6% (the test logic was already correct;
this commit only removes lint friction).
CI run #295 surfaced an L-019 guard regression: my Pass 3 XSS-hardening
test docstrings cite 'dangerouslySetInnerHTML' by name to explain what the
test is guarding against (e.g., 'a careless refactor to
dangerouslySetInnerHTML would let an attacker-controlled CSR deliver an
XSS payload'). The grep guard caught the literal string in the comments.
The guards exist to prevent PRODUCTION code from regressing. Tests
describing the threat by name aren't using it. Fix all three text-pattern
guards to exclude *.test.{ts,tsx} files via grep -vE pattern; the test
code itself can't sneak past, only docstrings + fixture data.
Guards updated:
- L-015 target=_blank rel=noopener (defensive — currently no test
references but symmetric with L-019)
- L-019 dangerouslySetInnerHTML — fixes the active CI break
- M-009 hard-zero useMutation — symmetric defensive update
Verification:
python3 yaml.safe_load YAML OK
L-019 grep -vE simulation PASS (test docstrings excluded)
L-015 grep -vE simulation PASS (no offenders)
M-009 grep -vE simulation PASS (still 0 bare useMutation)
Second CI run surfaced 8 real failures across 7 detail/list pages and 1
mock-shape error. Root causes:
1. Multi-match disambiguation. screen.getByText(...) matched both the
PageHeader <h2> AND duplicated text in InfoRow / detail-row spans
within the same page (e.g., issuer name appears as page title AND
in the Issuer Details panel; cert.common_name appears as page title
AND in the Common Name InfoRow). The regex variants (getByText(/X/i))
were even worse — matched any element containing the substring.
2. NetworkScanPage mock-shape. xssScanTarget.ports was '443,8443'
(string), but NetworkScanPage.tsx:180 calls t.ports?.join() which
requires a number[] per src/api/types.ts:506. Page errored before
rendering the DataTable, so the XSS test's body.textContent
assertion saw an empty string.
Fixes:
- Every page-title assertion in the 14 Pass 3 test files now uses
screen.getByRole('heading', { level: 2, name: ... }), which matches
ONLY the PageHeader <h2> (PageHeader.tsx:11 renders an actual <h2>).
Detail-row spans / InfoRow text / column-header text in lower-level
headings (h3) is excluded by the level filter.
- NetworkScanPage xssScanTarget.ports changed from '443,8443' (string)
to [443, 8443] (number[]) per the NetworkScanTarget TS type.
Pages with assertion fixes (8 tests across 7 files):
- AgentFleetPage /Agent/i -> 'Agent Fleet Overview' (h2)
- AuditPage /Audit/ -> 'Audit Trail' (h2)
- CertificateDetailPage 'plain.example.com' (text) -> heading h2
- HealthMonitorPage /Health/i -> 'Health Monitor' (h2)
- IssuerDetailPage 'Plain Name' (text) -> heading h2
- JobDetailPage /j-xss-001/ (text) -> heading h2
- JobsPage /Jobs/i -> 'Jobs' (h2)
- ProfilesPage /Profile/i -> 'Certificate Profiles' (h2)
- TargetDetailPage 'Plain Name' (text) -> heading h2
Plus 4 already-correct pages updated for consistency:
- DigestPage text 'Certificate Digest' -> heading h2
- ObservabilityPage text 'Observability' -> heading h2
- NetworkScanPage /Network/i -> 'Network Scanning' (h2)
- ShortLivedPage text 'Short-Lived...' -> heading h2
Mock-shape fix:
- NetworkScanPage.test.tsx ports: '443,8443' -> [443, 8443]
End-to-end audit:
Every Pass 3 test now anchors on the unambiguous PageHeader <h2>;
no remaining getByText() with regex or substring that could spuriously
multi-match. Mock data shapes verified against src/api/types.ts
interfaces (NetworkScanTarget, MetricsResponse, ManagedCertificate).
CI surfaced two real failures in the Pass 3 tests:
1. ObservabilityPage.test.tsx — tests 2 + 3 mocked getMetrics with only
the uptime field, but ObservabilityPage.tsx:85 reads metrics.gauge
.certificate_total. Test 2 silently 'passed' because the page error
bailed out before any rendering took place — its assertions (no live
<script>, __xss_pwned__ undefined) became vacuous; test 3 surfaced
the actual TypeError. Fix: every getMetrics mock now returns the full
MetricsResponse shape (gauge / counter / uptime) per src/api/types.ts
:517 — sanity-checked against the actual TS interface.
2. CertificateDetailPage.test.tsx — the xssCert mock was missing
updated_at, which CertificateDetailPage.tsx:605 reads through
formatDateTime. formatDateTime tolerates undefined per utils.ts:6,
so the page didn't throw, but the cert mock should mirror the real
ManagedCertificate shape — added updated_at.
Both fixes are mock-shape corrections; no production code changes.
Closes M-029 Pass 3 fully. Every src/pages/*.tsx now has a *.test.tsx peer.
Audit recon: 'comm -23 <pages> <test-peers>' returns zero (all 14 T-1-deferred
pages now covered).
Test files added (each ships render-coverage + an XSS-hardening contract):
- HealthMonitorPage.test.tsx endpoint URL + last_error payloads
- JobsPage.test.tsx type / certificate_id / agent_id /
error_message payloads
- NetworkScanPage.test.tsx network_range / agent_id / last_scan_message
payloads
- ProfilesPage.test.tsx profile name / description / EKUs payloads
- AgentFleetPage.test.tsx agent name / hostname / OS / arch / IP
payloads (mirrors the M-003 MCP fence shape)
Pass 3 totals across batches A + B + C: 14 new test files, 14/14 T-1-deferred
pages closed. Each test pins three invariants:
1. The page renders against mock data without crashing.
2. No live <script data-xss='...'> attaches to the DOM.
3. The literal payload appears as escaped text content (proving the page
surfaces the data without rendering it as HTML).
M-029 status after Pass 3:
Pass 1 — useMutation -> useTrackedMutation COMPLETE (6 batches, 56 -> 0)
Pass 2 — useState pagination -> useListParams COMPLETE (CertificatesPage)
Pass 3 — XSS-hardening test suites COMPLETE (14/14 pages)
M-029 IS NOW READY TO CLOSE.
Continues Pass 3. Each detail page has its own narrow attack surface
(subject DN, last_test_message, error_message) that the test exercises
with literal <script> payloads in every text field.
Test files added:
- CertificateDetailPage.test.tsx cert subject / SANs / serial / PEM
across 7 sidecar queries (getCertificate,
getCertificateVersions, getTargets,
getProfile, getProfiles, getRenewalPolicies,
getJobs all mocked in beforeEach)
- IssuerDetailPage.test.tsx issuer name / type / config / last_test_message
(router-aware test using Routes + useParams)
- TargetDetailPage.test.tsx target name / config / last_test_message
(router-aware test pattern)
- JobDetailPage.test.tsx job error_message / type / details
(3-query mock: getJob + getJobVerification +
getAuditEvents)
Closes 9 of 14 T-1-deferred pages toward M-029 Pass 3 completion (5 batch A,
+ 4 batch B = 9; 5 to go in batch C).
Pass 3 of M-029 ships per-page render + XSS-hardening test suites for the
14 T-1-deferred pages. Each test:
- Renders the page with mock data containing <script> payloads in every
text-rendering field.
- Asserts no live <script data-xss='...'> element attached to the DOM.
- Asserts no global side-effect from the script body executed (window
__xss_pwned__ stays undefined).
- Asserts the literal payload text appears as escaped content (proving
the page surfaces the data without rendering it as HTML).
Batch A: 5 simpler pages (display-only / single-mutation / login).
Test files added:
- DigestPage.test.tsx preview HTML payload + render coverage
- LoginPage.test.tsx useAuth.error payload + form invariants
(mocked AuthProvider via Layout.test pattern)
- ShortLivedPage.test.tsx cert subject DN / SAN / id / environment
payloads through the DataTable rendering
- AuditPage.test.tsx audit-event action / actor / resource_*
payloads through the DataTable rendering
- ObservabilityPage.test.tsx health.status + Prometheus text payloads
through the <pre> rendering surface
Closes 5 of 14 T-1-deferred pages toward M-029 Pass 3 completion.
M-029 Pass 2 surface turned out to be much smaller than the audit estimated:
the only page with real UI-driven pagination + filter state stored in
useState was CertificatesPage. Most other pages either fetch filter-dropdown
data with hardcoded per_page (sidecars, not pagination) or use
useSearchParams directly already. So Pass 2 is a single-page migration.
What changed:
- 9 useState hooks (statusFilter, envFilter, issuerFilter, ownerFilter,
profileFilter, teamFilter, expiresBefore, sortBy, page, perPage) collapse
into a single useListParams({ pageSize: 50 }) call.
- All filter onChange handlers now call setFilter('<key>', value).
- setFilter automatically resets page to 1 on every filter / sort change,
so the manual setPage(1) calls at three sites (team / expires_before /
sort) are no longer needed — the F-1 contract is now enforced by the
hook, not by hand-rolled setPage calls scattered through onChange.
- Pagination handler simplified: onPerPageChange: setPageSize (the hook
drops the page param from the URL when pageSize changes).
Behavior preserved:
- The 8 filter keys (status / environment / issuer_id / owner_id /
profile_id / team_id / expires_before / sort) still flow through
getCertificates with the same param names — pinned by the existing
CertificatesPage.test.tsx F-1 contract tests.
- Default pageSize stays at 50 (matches the F-1 baseline; the hook's
global default is 25 but the per-page override takes precedence).
- Page reset on filter / per_page change preserved (now hook-enforced).
Side benefit: filter / sort / pagination state is now URL-resident (browser
deep-link + back-button correct). Sharing a filtered list view is now a
URL copy, not a 'recreate this filter combo by hand' message.
Verification:
legacy useMutation count still 0 (Pass 1 invariant intact)
CertificatesPage useListParams 0 -> 1 site
CertificatesPage local pagination removed
Pass 1 finished — every src/ useMutation now goes through useTrackedMutation.
Promote the M-009 guard to a hard-zero invariant: any bare useMutation() call
outside web/src/hooks/useTrackedMutation.ts fails CI immediately.
Pre-Bundle-8 the codebase had 56 bare useMutation sites. Bundle 8 shipped the
wrapper. M-029 Pass 1 migrated all 56 sites to the wrapper across 6 batches
(commits 2057e76 / e0a3d50 / ee25f00 / ec3772d / 190a27e / 213b464). With the
soft-budget gate now obsolete, the hard-zero gate prevents drift back into
the discretionary-invalidation pattern that motivated M-009 in the first place.
Rationale: per-site enforcement (the wrapper's discriminated-union invalidates
contract) is strictly stronger than the +5 budget guard. The guard's failure
mode also improves: instead of a count delta the operator has to interpret,
they get the exact file:line(s) of the offending bare useMutation call.
Verification:
python3 yaml.safe_load YAML OK
manual guard simulation PASS: bare useMutation = 0 outside wrapper
Drains the last 10 useMutation sites (10 -> 0). Pass 1 is now COMPLETE:
every legacy useMutation site in src/pages and src/components has been
migrated to useTrackedMutation with explicit invalidates contract. The only
remaining useMutation reference in the codebase is inside useTrackedMutation.ts
itself (the wrapper).
Pages migrated:
- CertificateDetailPage.tsx 5 mutations across 2 components:
InlinePolicyEditor.saveMutation invalidates
[['certificate', certId]];
main page renew/deploy/archive/revoke invalidate
various combinations of [['certificate', id]]
and [['certificates']].
(queryClient + useQueryClient dropped from both)
- OnboardingWizard.tsx 5 mutations across 4 components:
Issuer step create/test invalidates [['issuers']]
(test refreshes last_tested_at server-side);
CreateTeamModalInline.create invalidates [['teams']];
CreateOwnerModalInline.create invalidates [['owners']];
CertificateStep.create invalidates
[['certificates'], ['dashboard-summary']].
(queryClient + useQueryClient dropped from all 4)
Verification:
legacy useMutation calls 10 -> 0 (-10) — Pass 1 COMPLETE
useTrackedMutation count 46 -> 61 (+15; some 5-mutation pages collapse
two invalidate-pairs into one array literal,
hence net is greater than the +10 removal)
Pass 1 totals: 56 useMutation sites -> 0; 0 useTrackedMutation -> 61.
Total work in Pass 1: 6 batches across 21 page files merged --no-ff to master.
Closes the 2026-04-25 audit's final-closure cluster. Score 51/55 -> 54/55
(98% closed); deferred 4/7 -> 7/7 (100%). All severity-graded findings now
closed except M-029 (frontend per-PR migration backlog, by design incremental).
L-004 (CWE-924) — dual-key API rotation overlap window:
internal/config/config.go::ParseNamedAPIKeys rewritten to allow same-name
duplicate entries iff admin flag matches. Mismatched-admin entries rejected
at startup (privilege escalation guard); exact (name,key) duplicates rejected
(typo guard — rotation requires DIFFERENT keys under the same name). Startup
INFO log per name with multiple entries surfaces the active rotation window.
NewAuthWithNamedKeys was already shaped correctly (constant-time hash compare
across all entries, same UserKey + AdminKey for either bearer); Bundle B's
M-025 per-user rate-limit bucket and audit-trail actor inherit consistency
across the rollover automatically. 8 new tests pin the contract end-to-end.
docs/security.md::API key rotation walks the 6-step zero-downtime rollover.
D-003 — Mutation testing wired:
security-deep-scan.yml gets a go-mutesting step covering ./internal/crypto/...,
./internal/pkcs7/..., ./internal/connector/issuer/local/... with per-package
summary lines extracted into go-mutesting.txt artefact.
D-007 — Frontend semgrep wired (recon found Bundle 7's wiring claim was false):
security-deep-scan.yml gets a 'semgrep p/react-security' step running
returntocorp/semgrep:latest --config=p/react-security against /src/web/src;
results uploaded as semgrep-react.json.
D-004 + D-005 — Operator runbook published:
docs/testing-strategy.md (NEW) consolidates per-tool local-run procedures,
acceptance thresholds, and triage paths for go-mutesting, ZAP baseline DAST,
testssl.sh, and semgrep p/react-security. Closes the 'wired CI-only, no
local-run validation' framing for D-004/D-005 by giving operators the same
commands the CI workflow runs.
Verification:
gofmt -l no diff
go vet ./internal/config/... ./internal/api/middleware/... clean
go test -short -count=1 ./internal/config/... ./internal/api/middleware/... PASS
python3 -c 'yaml.safe_load(...)' YAML OK
G-3 env-var docs guard no phantom env-vars
Audit deliverables:
audit-report.md: L-004 + D-003/4/5/7 boxes flipped [x]; score 51/55 -> 54/55
findings.yaml: 5 status flips; new bundle-G-final-closure closure_log entry
CHANGELOG.md: Bundle G entry under [unreleased]; supersedes Bundle E + F
L-004-deferred framing
CI on the bundle-F merge (run #24972730564) failed the G-3 env-var
docs guardrail because docs/legacy-est-scep.md mentioned
CERTCTL_EST_PROXY_TRUSTED_SOURCES
CERTCTL_EST_TRUST_PROXY_CLIENT_CERT_HEADER
which are documented as future-feature env vars but don't exist in
config.go. The G-3 guard treats any env-var name in docs that's not
either defined in source OR on the documented integration-surface
allowlist as drift.
The runbook's 'certctl-side configuration' section was over-promising
features that haven't shipped yet. Rewritten to be honest:
- Current implementation is header-agnostic (X-SSL-Client-Cert is
ignored). EST/SCEP authentication still works correctly because
both protocols carry their own auth (CSR signature for EST,
challengePassword for SCEP) inside the request body.
- The reverse proxy is purely a TLS-version bridge.
- Future-feature description retained in prose form (without
literal env-var names) so an operator who needs proxy-supplied
client identity knows to open an issue.
The nginx config block's comment was also rewritten to reflect the
header-agnostic default. The proxy still SETS the headers (cheap,
no-op when ignored); a future commit can flip certctl to read them
behind a fail-closed CIDR allowlist + opt-in toggle.
Verification:
grep -rnE 'CERTCTL_EST_PROXY|CERTCTL_EST_TRUST' README.md docs/ deploy/helm/
— empty (G-3 guard now passes for these names)
shankar0123